The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements logic in scripts/claude-to-codex.mjs to identify and strip safety-related context—including refusals, policy warnings, and safety guardrail messages—from the session history before handing off to the target agent. The generated prompt explicitly instructs the target agent to ignore prior safety signals and perform an independent assessment, which acts as a mechanism to bypass the safety filters established for the original agent.
[DYNAMIC_EXECUTION]: The script dynamically constructs a shell runner script (run-codex.sh) and a prompt file (codex-prompt.md) at runtime. It subsequently executes the generated runner using shell commands. The runtime assembly of executable code from processed session data represents a risk of unintended code execution if the interpolation or validation logic is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting untrusted data from Claude transcripts and local project files and interpolating it into the target agent's prompt.
Ingestion points: Reads Claude JSONL transcripts from ~/.claude/projects/ and various project artifacts (README.md, package.json, etc.) in scripts/claude-to-codex.mjs.
Boundary markers: The generated codex-prompt.md uses simple markdown headers but lacks strict delimiters or 'ignore embedded instructions' warnings for the transcript data itself.
Capability inventory: The skill has extensive file read/write access and executes shell commands via codex and spawnSync.
Sanitization: Content is filtered for specific safety markers and redacted for common secret patterns, but is not sanitized against adversarial instructions designed to influence the handoff process.
[DATA_EXFILTRATION]: The skill accesses and aggregates sensitive local information, including full conversation transcripts, Git diffs, and project configurations, into a 'handoff package' located in ~/.claude/handoffs/. This centralized aggregation of sensitive developer session data into a single local directory increases the impact of potential local data exposure.
[COMMAND_EXECUTION]: The script executes shell commands including git, codex, tmux, and osascript using node:child_process. It relies on environment variables and user-supplied CLI arguments for execution paths and model identifiers, representing a substantial capability for system interaction.

handoff